fix: confine installer writes to the selected target

[ahrazzle]

Existing target child symlinks could redirect pinned ingredient files and staging cleanup outside the chosen tree. Resolve the explicit target root once, then preflight every selected destination, staging and cleanup path, and contribution-state path before the first target mutation. Escaping child links return install exit 5. An intentionally linked root and confined payload-parent links remain supported.

Validation: 53 local tests and all five release gates pass. Ten target-boundary tests cover payload parents/leaves, staging cleanup, contribution-state destinations, a later unsafe ingredient preventing partial installation, and normal/linked-root installs; seven fail on the original main. A separate integration checkout with cache-authentication PR #17 passes 55 tests. All fixtures are synthetic and offline; outside canaries and directory inventories remain unchanged.

The checks run again at mutation boundaries but do not claim protection against concurrent hostile link replacement between a check and use. Ingredient gate commands are not sandboxed by this change.

Fixes #18

Automated posting by agentic team with human oversight.